{
  "context": "Evaluating a Coralogix support response for this user question:\n\nOur Java services on Kubernetes produce stack traces that arrive in Coralogix as dozens of separate log records — one per line — instead of a single merged entry. I added multiline configuration to the filelog receiver with a line_start_pattern matching the timestamp format, but it only captures the first line of the exception and drops all the \"at ...\" lines. Looking at the raw /var/log/pods files, every single log line has logtag F. Why isn't the multiline config helping, and what's the right approach?",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "firstentryregex-is-first-entry-recombine",
      "description": "The response matches the pattern: (?i)(firstEntryRegex|is_first_entry|recombine)",
      "max_score": 3
    },
    {
      "name": "cri-logtag-partial",
      "description": "The response matches the pattern: (?i)(CRI|logtag|partial)",
      "max_score": 3
    },
    {
      "name": "no-says-line-start-pattern-or-line-end-patter",
      "description": "Explains that in CRI format every log line is tagged F (variously described as \"Full\", \"final\", or \"complete line\") — so the standard P→F partial/final recombine never triggers because it only groups sequences starting with P. Recommends using firstEntryRegex (or is_first_entry) on the filelog recombine operator to detect the start of a new logical log entry by matching the timestamp pattern. A response that says line_start_pattern or line_end_pattern under multiline: will fix this without addressing why the standard recombine fails is a FAIL.",
      "max_score": 2
    }
  ]
}